W3 Total Cache <= 2.10.7 - Unauthenticated Minify Cache Poisoning via 'b' Parameter and Query String
- ID
- WPSEC-2026-1411
- Plugin
- W3 Total Cache (w3-total-cache)
- Affected
- all versions before 2.11.0
- Remediation
- Update to 2.11.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-73
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-21
- Attack surface
- W3 Total Cache on WPSec AttackSurface
- Fix released
- Published
Description
The W3 Total Cache plugin for WordPress is vulnerable to minify cache poisoning in all versions up to, and including, 2.10.7. In auto minify mode, public minified file requests accepted a query string on the file name, kept the request's 'b' (base) parameter, and derived the cache ID from the raw requested name. The base parameter could reroot the stored document-root-relative file list, and nothing stopped sources from inside the minify cache directory being used. This makes it possible for unauthenticated attackers to make the minifier build cached CSS/JS artifacts from files other than the intended ones, poisoning or misdirecting the minified assets served to site visitors.
References
- https://wpsec.com/vuln/WPSEC-2026-1411/
- https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/
- https://wordpress.org/plugins/w3-total-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS